diff options
| author | Casey Schaufler <casey@schaufler-ca.com> | 2013-12-19 13:23:26 -0800 |
|---|---|---|
| committer | Casey Schaufler <casey@schaufler-ca.com> | 2013-12-23 15:57:43 -0800 |
| commit | 4afde48be8929b6da63a9e977aaff0894ba82984 (patch) | |
| tree | 0e2ade1737801dd3a378278efabaaeaa7678cff5 | |
| parent | 00f84f3f2e9d088f06722f4351d67f5f577abe22 (diff) | |
| download | op-kernel-dev-4afde48be8929b6da63a9e977aaff0894ba82984.zip op-kernel-dev-4afde48be8929b6da63a9e977aaff0894ba82984.tar.gz | |
Smack: change rule cap check
smk_write_change_rule() is calling capable rather than
the more correct smack_privileged(). This allows for setting
rules in violation of the onlycap facility. This is the
simple repair.
Targeted for git://git.gitorious.org/smack-next/kernel.git
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
| -rw-r--r-- | security/smack/smackfs.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c index f5a6bb8..3198cfe 100644 --- a/security/smack/smackfs.c +++ b/security/smack/smackfs.c @@ -2152,7 +2152,7 @@ static ssize_t smk_write_change_rule(struct file *file, const char __user *buf, /* * Must have privilege. */ - if (!capable(CAP_MAC_ADMIN)) + if (!smack_privileged(CAP_MAC_ADMIN)) return -EPERM; return smk_write_rules_list(file, buf, count, ppos, NULL, NULL, |
